First talks at The Standoff: machine learning vulnerabilities, red teaming tools, and forensic artifacts

Less than a month is left until The Standoff, a unique global information security event. We are putting the finishing touches to the cyber-range infrastructure, completing the formation of the red and blue teams, and preparing the conference program, which will be an important part of the event.

Today we present the first group of speakers whose presentations have already been included in The Standoff discussion section. So here is what they will talk about.

Vulnerabilities of machine learning infrastructure

The boom of artificial intelligence brought to the market a set of impressive solutions both on hardware and software sides. On the other hand, massive implementation of AI in various areas brings about problems, and security is one of the greatest concerns.

Sergey Gordeychik, CIO at Inception Institute of Artificial Intelligence, will present results of hands-on vulnerability research of different components of AI infrastructure, including NVIDIA DGX GPU servers, ML frameworks, such as PyTorch, Keras, and TensorFlow, data processing pipelines and specific applications, including medical imaging and face recognition–powered CCTV. Also, updated Internet Census toolkit based on the Grinder framework will be introduced.

Red teaming simulation: unique attacks of lateral movements

In his career, Lawrence Amer, a vulnerability researcher at PwC's DarkLab, reported medium- and severe-level vulnerabilities in Adobe, Carbon Black, CrowdStrike, eBay, Facebook, Microsoft, Sony, and Yahoo. At The Standoff, Lawrence will talk about techniques of lateral movements, and how attackers can achieve their goals before they get on the radar. The speaker will also introduce frameworks and tools which will help red teams in their operations.

How to hack medical imaging applications via DICOM

Maria Nedyak, a developer at BI.ZONE, will talk about DICOM, one of the core technologies used in medical imaging applications along with machine learning.

Maria has conducted security analysis of popular DICOM servers, protocols, and libraries employed in medical imaging systems. In this talk, the speaker will present the most interesting security bugs in the DICOM ecosystem and demonstrate how easy it is to find critical flaws and how to fix them quickly.

SailfishOS: forensic artifacts

Krassimir Tzvetanov, an expert in information security and graduate research assistant at Purdue University, will talk about SailfishOS, a Linux kernel-based operating system, mostly deployed on cell phones. It is being rapidly deployed in Russia, India, and China, where it is used by government agencies and large companies, such as Huawei. While popularity is growing, there is no sufficient research in this space, so it is likely for investigators to encounter it in the field.

This presentation shows the mapping of the digital artifacts pertinent to an investigation, which can be found on the file system of a phone running SailfishOS 3.2. It covers call logs, text messages, location services, address books, and other important artifacts.

Safety of the Safari reader mode

You might have come across a nice article on a website fully loaded with different advertisements, funky background images and sounds. To deal with it, browser vendors created reader mode.

In his talk "My hacking adventures with Safari's reader mode," Nikhil Mittal, a security consultant at Payatu Software Labs will describe some major flaws in reader mode which result in security policy bypass.

We continue to accept applications from speakers. If you want to talk at The Standoff, please, fill out this form.